About jcandelaria

jcandelaria

Hi D_BB I would recommend submitting a case to our support and attach the CVE details so our support can check with our research team.

jcandelaria

This is a little bit tricky, since the agent is disconnected for a long time probably more than 180 or either some issue with agent itself that cause it to be disconnected to the tenant. Once its past 180 days, the endpoint is gone on from the table. I believe your issue might be that most of these endpoints have older-older 🙂 version possibly 7.1 A possible workaround is looking at agent audit logs then filter Sub-Type = Stop, then from there you can filter XDR Agent Version Contains contains 7.1 . That will give you the list of the agents to start with. Then you can compare the list with connected. Other option is to use a tool like sccm to check the protection status of the agent. You can submit a support case on this and ask for the registry that you can use.

jcandelaria

Hi Shmuel, Not sure what you mean by down? We will show the xdr agent status as below. Connected —The Cortex XDR agent has checked in within 10 minutes for standard endpoints, and within 3 hours for mobile endpoints. Connection Lost —The Cortex XDR agent has not checked in within 30 to 180 days for standard endpoints, and between 90 minutes and 6 hours for VDI and temporary sessions. Disconnected —The Cortex XDR agent has checked in within the defined inactivity window: between 10 minutes and 30 days for standard and mobile endpoints, and between 10 minutes and 90 minutes for VDI and temporary sessions. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-response/investigate-endpoints/view-details-for-an-endpoint You can also create a filter from endpoint administration using Last Seen. ex. screenshot below with endpoint status disconnected and last seen 7 Days

jcandelaria

Hi CraigV123, Is there a specific function/purpose on those servers that you observe? Like AD, SQL or specific task happening during that time of the day its causing high cpu?

jcandelaria

You may have to tweak your queries to combine by using "join". Here's a sample of join

jcandelaria · ‎06-28-2021

Hi Rodrigoduarte Yes, if you are looking for the mitre id inside the syslog alert itself, its not included as specified by link posted by Etugriceri Feature request can be requested on this.

jcandelaria · ‎06-26-2021

Hi Rodrigoduarte, Are you saying that you cant create this filter? then select the syslog server you set-up?

jcandelaria · ‎06-25-2021

Hi Doug, Hopefully my reply isnt that too late.. as you know XDR have compatibility issue with Cylance so yes, uninstall cylance before install xdr agent. And hopefully, you have done some canary group with no Cylance and XDR in block mode. That way at least you will get somewhere around 60-70% of the executables known to xdr and the rest, you can deal when incident triggers. Also when you remove cylance, usually the defender takes over if the xdr profile is set to report mode but once you switch to blocking mode then xdr will be registered as primary AV in security center. What I've seen from some customer, remove the cylance, install xdr agent but only specific modules are in blocking mode while the rest are in report mode. That way the SOC doesnt get overwhelm with all new alerts at the same time.. then slowly switching each module to block mode. What i would suggest is get a good understanding of XDR agent as incident source as those are the ones that will get blocked and how to address them so that way even if you deploy xdr agent all modules in block mode, you can easily manage and address those incidents on the right away.

jcandelaria · ‎06-23-2021

Hi Ruslanal, Do you have any information on the alert what is the suspicious communication all about? Something to start with in terms of investigating? If you have Pro license, there is analytics and analytics bioc incidents/alerts that you can check. But if you have specific information to start with, you can use query builder/xql to start your investigation/threat hunting

jcandelaria · ‎06-21-2021

The answer is yes, they can co-exist but as general reminder, anytime there are 2 AVs, there will always be a spike in resources. From deployment overview, you can put the XDR in report while defender in blocking then do tuning and once you are ready, you can put the xdr in blocking which will be registered as your primary AV in security center and defender will be disabled but you can always configure schedule scan on defender and make sure you dont do it the same time as xdr.. As always, you can contact your account team if you want Professional services to help you on your initial deployment.

jcandelaria · ‎04-23-2021

a malicious executable is found on that device, why does the alert show as "Detected (Scanned)" for the file? Detected (Scanned) means we detected the file as malware during the scan. Is the endpoint protected from that malicious executable? Yes, because the default policy is in block mode Based on the default setting, would that file be blocked if it attempted to execute and since it is dormant, it has only been identified during the scan but no action is necessary (other than an alert)? yes it will be blocked, there is a setting to change quarantine malicious executable where you can change it to Quarantine Wildfire Malware verdict so that way file that is scanned and if it has WF malware verdict then it will be quarantined. Step 3 --> option 2 from the link below https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile

jcandelaria · ‎03-15-2021

@tfoley the endpoint group is not yet available/expose in our XQL xdr data fields

jcandelaria · ‎03-11-2021

@iscott Do you have mixed of Pro vs Prevent license? Around 300mb is the average memory with most of the features turn on with EDR enabled. Can you check if endpoint with 180mb have pro license enabled and EDR or just prevent?

jcandelaria · ‎03-10-2021

@grenzi good to know that the agent is working and connected..

jcandelaria · ‎03-10-2021

@grenzi Have you tried restarting the xdr service? or is it the same even after you restarted the server itself?

Member Since	‎02-17-2016 02:37 PM
Date Last Visited	56m ago
Posts	28
Total Likes Received	5

Online Status	Offline
Date Last Visited	56m ago

About jcandelaria

Re: Hivenightmare

Re: Devices that are down cortex XDR

Re: Devices that are down cortex XDR

Re: High memory consumption on newer agent versions

Re: XQL Query for CVE-2021-1675 exploitation attempts (printnightmare)

Re: Cortex XDR Agent rollout strategy

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

Re: Cortex XDR Co-Existing with MDfE

Re: XDR agent is showing high memory consumption

Re: High memory consumption on newer agent versions

Re: Cortex XDR 7.4.1 crashing server

Re: in XDR.. what are the steps if we need to create the group based on subnet

Cortex Components in plain english / non-secops terms

Re: Network Visibility on Cortex XDR

Re: Hivenightmare

Re: Devices that are down cortex XDR

Re: Devices that are down cortex XDR

Re: High memory consumption on newer agent versions

Re: XQL Query for CVE-2021-1675 exploitation attempts (printnightmare)

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

Re: Forward the Miter ID field by Syslog in CEF format, is it possible?

Re: Cortex XDR Agent rollout strategy

Re: Network Visibility on Cortex XDR

Re: Cortex XDR Co-Existing with MDfE

Re: Cortex XDR - Detected (Scanned) alert for malware

Re: Filtering by Endpoint groups

Re: XDR agent is showing high memory consumption

Re: Windows Server 2003 unable to check in to TMS

Re: Windows Server 2003 unable to check in to TMS

Network Security

Cloud Security

Security Operations

About jcandelaria